"""Read-only verification of a trusted, source-bound assessment receipt; no services."""
import hashlib
import json
from pathlib import Path


def verify(repository, receipt_path, expected_sha256):
    repository = Path(repository).resolve()
    raw = Path(receipt_path).read_bytes()
    if len(raw) > 8 * 1024 * 1024 or hashlib.sha256(raw).hexdigest() != expected_sha256:
        raise ValueError('Assessment receipt differs from the protected manifest pin')
    receipt = json.loads(raw)
    if (receipt.get('schemaVersion') != 1 or receipt.get('scope') != 'P10-00-ASSESSMENT-ONLY'
            or receipt.get('integrity') != 'PASS' or not receipt.get('files')
            or not receipt.get('nativeReports') or not receipt.get('retainedDecisions')):
        raise ValueError('Incomplete assessment qualification receipt')
    for name, expected in receipt['files'].items():
        path = (repository / name).resolve()
        if not path.is_relative_to(repository) or not path.is_file():
            raise ValueError('Frozen assessment source missing or outside repository: ' + name)
        if hashlib.sha256(path.read_bytes()).hexdigest() != expected:
            raise ValueError('Frozen assessment source changed; fresh affected qualification required: ' + name)
    evidence_root = Path(receipt_path).resolve().parent
    for name, expected in receipt.get('evidenceFiles', {}).items():
        path = (evidence_root / name).resolve()
        if not path.is_relative_to(evidence_root) or not path.is_file() or hashlib.sha256(path.read_bytes()).hexdigest() != expected:
            raise ValueError('Accepted handoff evidence changed or missing: ' + name)
    return dict(kind='REUSED_SOURCE_BOUND_EVIDENCE', receiptSha256=expected_sha256,
                nativeReports=receipt['nativeReports'],
                retainedDecisions=receipt['retainedDecisions'],
                limits='P10-00 assessment only. No fresh product runs or implementation qualification.')